nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

CIFS share auditing

FelixZhou

we are looking for CIFS auditing on tracing of any shared folder or file deletions.

we enabled audit on SVM and directed the log file, also set up the deletion auditing on shares. But didn't see events on event log for these deletion events.

are there any steps missing here?

Please share your experience. thanks.

Find more posts tagged with

Accepted answers

scottgelb

The documentation is very good but there are SACL steps needed and it is hard to find the end-to-end procedure in one place, so I wrote a blog on it for both CIFS and NFS 🙂 Please see the blog and let me know if you have any questions or comments.

https://storageexorcist.wordpress.com/2020/06/03/ontap-native-nas-auditing-smb-and-nfs/

All comments

JGPSHNTAP

That is not an enterprise solution what you are doing.

You should be looking at third policy fpolicy tools

The way you are talking is you would need to re-acl the ntfs permissions with auditing and that's not scalable.

scottgelb

https://storageexorcist.wordpress.com/2020/06/03/ontap-native-nas-auditing-smb-and-nfs/

JGPSHNTAP

Scott,

Very well written blog. However, not scalable to large enterprises. This works good if you are looking for something quick.

The correct answer in my opinion would be fpolicy

scottgelb

Thank you... agreed you get what you pay for ... but lot of customers use the native, free tools. I do also recommend 3rd party for scaling, enterprise features and management, but this blog was the result of so many that needed to get the free stuff working. All of my customers are enterprise so more than I thought that would use this.

JGPSHNTAP

I just think it was important to set the proper expectations